Выполнение произвольного кода в Microsoft Windows Common Control Library ActiveX компоненте

Дата публикации:	10.04.2012
Дата изменения:	01.05.2014
Всего просмотров:	9099
Опасность:	Критическая
Наличие исправления:	Да
Количество уязвимостей:	1
CVSSv2 рейтинг:	10 (AV:N/AC:L/Au:N/C:C/I:C/A:C/E:H/RL:O/RC:C)
CVE ID:	CVE-2012-0158
Вектор эксплуатации:	Удаленная
Воздействие:	Компрометация системы
CWE ID:	Нет данных
Наличие эксплоита:	Активная эксплуатация уязвимости
Уязвимые продукты:	Microsoft BizTalk Server 2002 Microsoft Commerce Server 2002 Microsoft Commerce Server 2007 Microsoft Commerce Server 2009 Microsoft Office 2003 Professional Edition Microsoft Office 2003 Small Business Edition Microsoft Office 2003 Standard Edition Microsoft Office 2003 Student and Teacher Edition Microsoft Office 2003 Web Components Microsoft Office 2007 Microsoft Office 2010 Microsoft SQL Server 2000 Microsoft SQL Server 2000 Analysis Services Microsoft SQL Server 2005 Microsoft SQL Server 2005 Express Edition Microsoft SQL Server 2008 Microsoft Visual Basic 6.x Microsoft Visual FoxPro 8.x Microsoft Visual FoxPro 9.x
	Уязвимые версии: Microsoft Office 2003 Microsoft Office 2003 Web Components Service Pack 3 Microsoft Office 2007 Service Pack 2 Microsoft Office 2007 Service Pack 3 Microsoft Office 2010 (32-bit editions) Microsoft Office 2010 Service Pack 1 (32-bit editions) Microsoft SQL Server 2000 Analysis Services Service Pack 4 Microsoft SQL Server 2000 Service Pack 4 Microsoft SQL Server 2005 Express Edition with Advanced Services Service Pack 4 Microsoft SQL Server 2005 for 32-bit Systems Service Pack 4 Microsoft SQL Server 2005 for Itanium-based Systems Service Pack 4 Microsoft SQL Server 2005 for x64-based Systems Service Pack 4 Microsoft SQL Server 2008 for 32-bit Systems Service Pack 2 Microsoft SQL Server 2008 for 32-bit Systems Service Pack 3 Microsoft SQL Server 2008 for x64-based Systems Service Pack 2 Microsoft SQL Server 2008 for x64-based Systems Service Pack 3 Microsoft SQL Server 2008 for Itanium-based Systems Service Pack 2 Microsoft SQL Server 2008 for Itanium-based Systems Service Pack 3 Microsoft SQL Server 2008 R2 for 32-bit Systems Microsoft SQL Server 2008 R2 for x64-based Systems Microsoft SQL Server 2008 R2 for Itanium-based Systems Microsoft BizTalk Server 2002 Service Pack 1 Microsoft Commerce Server 2002 Service Pack 4 Microsoft Commerce Server 2007 Service Pack 2 Microsoft Commerce Server 2009 Microsoft Commerce Server 2009 R2 Microsoft Visual FoxPro 8.0 Service Pack 1 Microsoft Visual FoxPro 9.0 Service Pack 2 Visual Basic 6.0 Runtime Описание: Уязвимость позволяет удаленному пользователю выполнить произвольный код на целевой системе. Уязвимость существует из-за ошибки в MSCOMCTL.TreeView, MSCOMCTL.ListView2, MSCOMCTL.TreeView2 и MSCOMCTL.ListView компонентах (MSCOMCTL.OCX). Удаленный пользователь может с помощью специально сформированной Web-страницы вызвать повреждение памяти и выполнить произвольный код на целевой системе. Примечание: уязвимость активно эксплуатируется в настоящее время. URL производителя: www.microsoft.com Решение: Установите исправление с сайта производителя.
	Microsoft Office 2003 Service Pack 3: http://www.microsoft.com/downloads/details.aspx?FamilyId=d0d34b4f-4bcd-4df7-8ebc-87367e889959 Microsoft Office 2003 Web Components Service Pack 3: http://www.microsoft.com/downloads/details.aspx?FamilyId=d0d34b4f-4bcd-4df7-8ebc-87367e889959 Microsoft Office 2007 Service Pack 2: http://www.microsoft.com/downloads/details.aspx?FamilyId=17294713-5c03-4439-bcae-471e9b1e1ac9 Microsoft Office 2007 Service Pack 3: http://www.microsoft.com/downloads/details.aspx?FamilyId=17294713-5c03-4439-bcae-471e9b1e1ac9 Microsoft Office 2010 (32-bit editions): http://www.microsoft.com/downloads/details.aspx?FamilyId=23c9d7bf-c9e0-4e01-8b66-da542332a28b Microsoft Office 2010 Service Pack 1 (32-bit editions): http://www.microsoft.com/downloads/details.aspx?FamilyId=23c9d7bf-c9e0-4e01-8b66-da542332a28b Microsoft SQL Server 2000 Analysis Services Service Pack 4: http://www.microsoft.com/downloads/details.aspx?FamilyId=198f1819-818b-4b2e-a424-4a45729746eb Microsoft SQL Server 2000 Service Pack 4: http://www.microsoft.com/downloads/details.aspx?FamilyId=2a9d97e8-79e0-4997-88fe-1224707e1b37 Microsoft SQL Server 2005 Express Edition with Advanced Services Service Pack 4: http://www.microsoft.com/downloads/details.aspx?FamilyId=d0d34b4f-4bcd-4df7-8ebc-87367e889959 Microsoft SQL Server 2005 for 32-bit Systems Service Pack 4: http://www.microsoft.com/downloads/details.aspx?FamilyId=d0d34b4f-4bcd-4df7-8ebc-87367e889959 Microsoft SQL Server 2005 for Itanium-based Systems Service Pack 4: http://www.microsoft.com/downloads/details.aspx?FamilyId=d0d34b4f-4bcd-4df7-8ebc-87367e889959 Microsoft SQL Server 2005 for x64-based Systems Service Pack 4: http://www.microsoft.com/downloads/details.aspx?FamilyId=d0d34b4f-4bcd-4df7-8ebc-87367e889959 Microsoft SQL Server 2008 for 32-bit Systems Service Pack 2: http://www.microsoft.com/downloads/details.aspx?FamilyId=17294713-5c03-4439-bcae-471e9b1e1ac9 Microsoft SQL Server 2008 for 32-bit Systems Service Pack 3: http://www.microsoft.com/downloads/details.aspx?FamilyId=17294713-5c03-4439-bcae-471e9b1e1ac9 Microsoft SQL Server 2008 for x64-based Systems Service Pack 2: http://www.microsoft.com/downloads/details.aspx?FamilyId=17294713-5c03-4439-bcae-471e9b1e1ac9 Microsoft SQL Server 2008 for x64-based Systems Service Pack 3: http://www.microsoft.com/downloads/details.aspx?FamilyId=17294713-5c03-4439-bcae-471e9b1e1ac9 Microsoft SQL Server 2008 for Itanium-based Systems Service Pack 2: http://www.microsoft.com/downloads/details.aspx?FamilyId=17294713-5c03-4439-bcae-471e9b1e1ac9 Microsoft SQL Server 2008 for Itanium-based Systems Service Pack 3: http://www.microsoft.com/downloads/details.aspx?FamilyId=17294713-5c03-4439-bcae-471e9b1e1ac9 Microsoft SQL Server 2008 R2 for 32-bit Systems: http://www.microsoft.com/downloads/details.aspx?FamilyId=17294713-5c03-4439-bcae-471e9b1e1ac9 Microsoft SQL Server 2008 R2 for x64-based Systems: http://www.microsoft.com/downloads/details.aspx?FamilyId=17294713-5c03-4439-bcae-471e9b1e1ac9 Microsoft SQL Server 2008 R2 for Itanium-based Systems: http://www.microsoft.com/downloads/details.aspx?FamilyId=17294713-5c03-4439-bcae-471e9b1e1ac9 Microsoft BizTalk Server 2002 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?FamilyId=d90b78d2-551b-499b-9bd2-85b40646dbc7 Microsoft Commerce Server 2002 Service Pack 4: http://www.microsoft.com/downloads/details.aspx?FamilyId=35de8833-50ae-482d-aa07-497bf68fb38e Microsoft Commerce Server 2007 Service Pack 2: http://www.microsoft.com/downloads/details.aspx?FamilyId=3f04fb90-8f11-4392-a4bc-800903091f04 Microsoft Commerce Server 2009: http://www.microsoft.com/downloads/details.aspx?FamilyId=a8998b6b-e9a4-457e-a34f-0458dda81f2f Microsoft Commerce Server 2009 R2: http://www.microsoft.com/downloads/details.aspx?FamilyId=e9221811-8913-412b-ae04-21a55ce7c4c5 Microsoft Visual FoxPro 8.0 Service Pack 1: http://www.microsoft.com/downloads/details.aspx?FamilyId=3a7ff474-f1e0-4c86-9555-64e8e7357890 Microsoft Visual FoxPro 9.0 Service Pack 2: http://www.microsoft.com/downloads/details.aspx?FamilyId=53c0132e-7724-4e94-abe9-e79b76ce35d7 Visual Basic 6.0 Runtime: http://www.microsoft.com/downloads/details.aspx?FamilyId=0afe933a-1e62-45c4-910c-ea94b203df5a
Ссылки:	MS12-027: Vulnerability in Windows Common Controls Could Allow Remote Code Execution (2664258) MS12-027 MSCOMCTL ActiveX Buffer Overflow Exploit (meta)
Журнал изменений:	a:2:{s:4:"TEXT";s:36:"28.04.2012 Добавлен эксплоит.";s:4:"TYPE";s:4:"html";}

Выполнение произвольного кода в Microsoft Windows Common Control Library ActiveX компоненте

Подпишитесь на email рассылку